Solaris

Hello guys,

I have been trying to set up my DSEE 6.3 on Solaris 10 using proxy with tls:simple authentication. I follow all the steps mentioned in the Installation Guide on Sun's site but there is a problem with ldapclient init when I use hostname instead of IP address in the Default Server List.

Here is the config for default profile :

1 Domain to serve : test.ldap
2 Base DN to setup : dc=test,dc=ldap
3 Profile name to create : default
4 Default Server List : pluto
5 Preferred Server List : pluto
6 Default Search Scope : one
7 Credential Level : proxy
8 Authentication Method : tls:simple
9 Enable Follow Referrals : FALSE
10 iDS Time Limit :
11 iDS Size Limit :
12 Enable crypt password storage : TRUE
13 Service Auth Method pam_ldap :
14 Service Auth Method keyserv :
15 Service Auth Method passwd-cmd:
16 Search Time Limit : 30
17 Profile Time to Live : 43200
18 Bind Limit : 10
19 Enable shadow update : FALSE


ldapsearch did not work before I installed the server certificate on the client machine using certutil. after certificate is ok, then ldapearch works fine over secure port.

I initialize the Solaris 10 client with the following command :

ldapclient -v init -a proxypassword=password -a proxydn=cn=smsproxy,ou=profile,dc=test,dc=ldap -a profilename=default -a domainname=test.ldap 10.1.1.29


In ldapclien manual it says when using TLS server list in the profile should be as hostnames not IP addresses. If I use IP addresses ldapclient init is OK but ldaplist, If I use hostname then ldapclient init fails. It looks like there was a sort of name resolution problem but all the names exist in the /etc/hosts file and nsswitch.conf configured to look at files.


I hope I was able to clarify my problem. Any help would be appreciated.

Thanks,
Niyazi

I have had the exact same experience as you.
If I used the Ip then ldapclient init worked as a charm but not with hostname.
Its almost as ldapclient does not resolv the hostname, just assumes its an IP and goes for it :/

Noone managed to run DSEE with TLS:simple ???

It worked fine for me and I was using IP addresses. By the way, the documentation doesn't states a hostname must be used when TLS is enabled, only that there should be a full match between what is in the certificate and what is in the name service (hosts or dns).

Could you please send me the instructions ? The one on bigadmin site does not work. I am using Solaris 10 with the latest recommended patches applied.

Please post the precise instructions you followed and show where it fails, including error messages.

Hello,

I have a three test servers : ldap server, ldap client and dns server (non-global zones but not shared)

My nsswitch.conf is ok and /etc/resolv.conf on ldap server and client points to test dns server. nslookups look fine.


I install the DSEE 6.3.1 on Solaris 10 on Sparc from native packages. Everything goes well.

After the software installation, I login to java web console and initialize dscc registry. No errors.

I create a server instance with the default settings.


I run /usr/lib/ldap/idsconfig

here is summary output:


Summary of Configuration

1 Domain to serve : test.ldap
2 Base DN to setup : dc=test,dc=ldap
Suffix to create : dc=test,dc=ldap
Database to create : test
3 Profile name to create : default
4 Default Server List : 10.1.1.28:1389
5 Preferred Server List : 10.1.1.28:1389
6 Default Search Scope : sub
7 Credential Level : proxy
8 Authentication Method : tls:simple
9 Enable Follow Referrals : FALSE
10 iDS Time Limit :
11 iDS Size Limit :
12 Enable crypt password storage : FALSE
13 Service Auth Method pam_ldap :
14 Service Auth Method keyserv :
15 Service Auth Method passwd-cmd:
16 Search Time Limit : 30
17 Profile Time to Live : 43200
18 Bind Limit : 10
19 Enable shadow update : FALSE
20 Service Search Descriptors Menu


I enter the password for proxy agent and the default schema is initialized with no errors.

Now, I export my server certificate from ldap server with the following command :


# /opt/SUNWdsee/ds6/bin/dsadm export-cert -o /tmp/server-certificate /space/DS/ds1 defaultCert



I copy this certificate to the client machine and before importing the cert I run ldapsearch command



# ldapsearch -v -h 10.1.1.28 -p 1686 -Z -P /var/ldap/cert8.db -b "dc=test,dc=ldap" -s base "objectclass=*"


can not connect to ldap server.


I import the certificate into client cert db using : (* cert db is initialized with /usr/sfw/bin/certutil -N -d /var/ldap )

/usr/sfw/bin/certutil -A -i /tmp/server-certificate -n "Server Certificate" -t "CT" -d /var/ldap


I run the ldapsearch command again and it works fine. This means SSL is working and my certificate is installed properly, right ?


Now I initialize the client with ldapclient command :

# ldapclient -v init -a proxypassword=password -a proxydn=cn=proxyagent,ou=profile,dc=test,dc=ldap -a domainname=test.ldap -a certificatePath=/var/ldap 10.1.1.28

success...

I remove ldap [NOTFOUND=return] line from my nsswitch.conf

ldapsearch command works fine again but ldaplist command fails with no available connection error. I could not find any way to debug the failure.

on ldap client /var/adm/messages shows :

May 18 09:06:55 eris ldap_cachemgr[23856]: [ID 293258 daemon.warning] libsldap: Status: 91 Mesg: openConnection: simple bind failed - Can't connect to the LDAP server
May 18 09:06:55 eris ldap_cachemgr[23856]: [ID 292100 daemon.warning] libsldap: could not remove 10.1.1.28 from servers list
May 18 09:06:55 eris ldap_cachemgr[23856]: [ID 293258 daemon.warning] libsldap: Status: 7 Mesg: Session error no available conn.
May 18 09:06:55 eris ldap_cachemgr[23856]: [ID 186574 daemon.error] Error: Unable to refresh profile:default: Session error no available conn.



Thank you for help.